@nebulr-group/bridge-cli 0.6.6 → 1.0.0-alpha.0

package/dist/auth/loopback.js

@@ -6,24 +6,23 @@
  *  - Use an OS-assigned ephemeral port (`port: 0`).
  *  - Handle exactly one request, then close the listener.
  *
- * The server understands two response shapes from the IdP:
- *   `?code=<code>&state=<state>`            → success
- *   `?error=access_denied&state=<state>`    → user cancelled (or other error)
+ * The server understands two response shapes from the sign-in page:
+ *   `?code=<code>&state=<state>&iss=<issuer>`    → success
+ *   `?error=access_denied&state=<state>`          → the person cancelled (or another error)
  *
- * It also CSRF-checks the returned `state` against the value the caller
- * generated.
+ * It CSRF-checks the returned `state` against the value the caller
+ * generated, and requires the issuer the page names (`iss`, RFC 9207) to be
+ * the one the CLI signs in to, so a code from another issuer is never traded.
  */
 import * as http from 'node:http';
 /**
  * Bridge wordmark — inlined SVG so the page renders without any network fetch.
  * `fill="currentColor"` makes it themable via CSS `color`.
- * Source: bridge-cloud-views/static/assets/logos/bridge_logo.svg (color stripped).
  */
 const BRIDGE_LOGO = `<svg viewBox="0 0 818 148" xmlns="http://www.w3.org/2000/svg" aria-label="The Bridge" role="img"><path d="M668.241 0.0799866C684.368 0.0801786 696.657 3.98507 705.105 11.7929C713.026 19.1143 717.515 29.8687 718.572 44.0547C718.691 45.659 717.471 47.0329 715.868 47.1651L686.915 49.5511C685.213 49.6914 683.752 48.3801 683.562 46.6823C682.997 41.6277 681.537 37.8701 679.183 35.4091C676.367 32.3372 672.272 30.8008 666.896 30.8007C661.392 30.8007 656.783 32.5927 653.071 36.1767C649.487 39.6326 646.8 44.5604 645.008 50.9599C643.216 57.2319 642.319 64.5929 642.319 73.0409C642.319 81.4885 643.279 88.657 645.199 94.5448C647.119 100.433 649.936 104.977 653.648 108.177C657.36 111.248 661.776 112.785 666.896 112.785C672.656 112.785 677.135 110.734 680.334 106.639C683.534 102.543 685.136 96.5923 685.136 88.7851C685.136 87.8304 684.362 87.0565 683.408 87.0565H661.447C659.79 87.0565 658.447 85.7134 658.447 84.0565V62.9833C658.447 61.3265 659.79 59.9833 661.447 59.9833H716.695C718.352 59.9833 719.695 61.3265 719.695 62.9833V143.96C719.695 145.617 718.352 146.96 716.695 146.96H692.4C690.803 146.96 689.487 145.709 689.404 144.115L687.838 113.854C687.83 113.685 687.69 113.553 687.521 113.553C687.364 113.553 687.231 113.668 687.207 113.823C685.525 124.573 681.955 132.931 676.497 138.897C671.121 144.913 663.566 147.921 653.838 147.921C644.111 147.921 635.536 144.782 628.113 138.511C620.817 132.239 615.12 123.537 611.024 112.401C607.056 101.137 605.071 88.2723 605.071 73.8085C605.071 59.0885 607.439 46.2237 612.175 35.2157C617.039 24.0798 624.145 15.4408 633.489 9.29678C642.961 3.153 654.545 0.0799866 668.241 0.0799866Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M245.083 1.04092C254.682 1.041 262.683 2.63982 269.083 5.83975C275.482 9.03973 280.154 13.3281 283.098 18.704C286.17 24.0797 287.706 29.9675 287.707 36.3671C287.707 44.5587 285.21 51.855 280.218 58.2548C275.401 64.5932 268.511 68.7991 259.55 70.8689C259.398 70.9041 259.289 71.0397 259.289 71.1961C259.289 71.3696 259.423 71.5143 259.596 71.5302C269.811 72.4674 277.582 75.9152 282.905 81.871C288.409 87.759 291.161 95.9522 291.161 106.448C291.161 119.12 286.489 129.04 277.145 136.208C267.929 143.376 255.257 146.96 239.129 146.96H187.986C186.329 146.96 184.986 145.617 184.986 143.96V4.04093C184.986 2.38407 186.329 1.04092 187.986 1.04092H245.083ZM221.657 112.472C221.657 114.128 223 115.472 224.657 115.472H235.866C241.754 115.472 246.104 114.191 248.92 111.631C251.864 108.943 253.338 105.231 253.338 100.495C253.338 95.7595 251.864 92.1125 248.92 89.5526C246.104 86.8649 241.753 85.5214 235.866 85.5214H224.657C223 85.5214 221.657 86.8645 221.657 88.5214V112.472ZM221.657 60.4403C221.657 62.0972 223 63.4403 224.657 63.4403H235.098C240.729 63.4403 244.953 62.0964 247.769 59.4091C250.585 56.5931 251.994 52.7506 251.994 47.8866C251.993 42.8953 250.585 39.0549 247.769 36.3671C244.953 33.6797 240.729 32.3359 235.098 32.3358H224.657C223 32.3358 221.657 33.679 221.657 35.3358V60.4403Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M365.258 1.04092C379.849 1.04104 390.793 4.23949 398.088 10.6386C405.384 17.0386 409.034 25.5527 409.034 36.1767C409.034 45.0084 406.537 52.7533 401.545 59.4091C396.593 65.8845 388.87 70.5342 378.376 73.357C378.227 73.397 378.123 73.5319 378.123 73.6857C378.123 73.8626 378.259 74.0098 378.436 74.0249C384.683 74.5595 389.507 76.0248 392.906 78.4169C396.489 80.8489 399.176 84.4331 400.968 89.1689C402.76 93.7768 404.362 100.562 405.77 109.521C407.434 119.12 408.905 126.863 410.185 132.751C411.588 138.62 413.246 143.283 415.158 146.735C415.171 146.758 415.177 146.783 415.177 146.809C415.177 146.892 415.11 146.96 415.026 146.96H377.595C376.304 146.96 375.152 146.135 374.778 144.899C373.912 142.04 373.171 139.015 372.553 135.824C371.913 131.728 371.019 126.031 369.867 118.735C368.715 110.288 367.689 104.335 366.793 100.879C365.897 97.4234 364.361 94.8639 362.185 93.2001C360.009 91.5363 356.746 90.7041 352.394 90.704H345.026C343.369 90.704 342.026 92.0472 342.026 93.704V143.96C342.026 145.617 340.683 146.96 339.026 146.96H308.355C306.698 146.96 305.355 145.617 305.355 143.96V4.04093C305.355 2.38407 306.698 1.04092 308.355 1.04092H365.258ZM342.026 62.1689C342.026 63.8257 343.369 65.1689 345.026 65.1689H354.313C360.073 65.1689 364.554 63.7602 367.754 60.9442C370.954 58.0003 372.553 53.9674 372.553 48.8476C372.553 43.7278 370.954 39.6948 367.754 36.7509C364.554 33.8069 360.073 32.3358 354.313 32.3358H345.026C343.369 32.3358 342.026 33.679 342.026 35.3358V62.1689Z" fill="currentColor"/><path d="M463.892 143.96C463.892 145.617 462.549 146.96 460.892 146.96H430.221C428.564 146.96 427.221 145.617 427.221 143.96V4.04093C427.221 2.38407 428.564 1.04092 430.221 1.04092H460.892C462.549 1.04092 463.892 2.38407 463.892 4.04092V143.96Z" fill="currentColor"/><path fill-rule="evenodd" clip-rule="evenodd" d="M526.892 1.04092C540.716 1.04106 552.556 4.11101 562.412 10.2548C572.395 16.3987 579.947 24.9756 585.067 35.9833C590.315 46.9913 592.939 59.6005 592.939 73.8085C592.939 88.6562 590.315 101.584 585.067 112.592C579.947 123.599 572.395 132.111 562.412 138.127C552.556 144.015 540.716 146.96 526.892 146.96H484.962C483.306 146.96 481.962 145.617 481.962 143.96V4.04093C481.962 2.38407 483.306 1.04092 484.962 1.04092H526.892ZM518.443 111.127C518.443 112.784 519.786 114.127 521.443 114.127H526.315C535.531 114.127 542.699 110.929 547.819 104.529C553.067 98.1293 555.691 87.8882 555.691 73.8085C555.691 60.1128 553.067 50.065 547.819 43.6649C542.571 37.1369 535.403 33.871 526.315 33.871H521.443C519.786 33.871 518.443 35.2141 518.443 36.871V111.127Z" fill="currentColor"/><path d="M817.409 29.3358C817.409 30.9927 816.066 32.3358 814.409 32.3358H775.866C774.209 32.3358 772.866 33.679 772.866 35.3358V55.6386C772.866 57.2954 774.209 58.6386 775.866 58.6386H811.722C813.379 58.6386 814.722 59.9817 814.722 61.6386V84.247C814.722 85.9038 813.379 87.247 811.722 87.247H775.866C774.209 87.247 772.866 88.5901 772.866 90.247V112.472C772.866 114.128 774.209 115.472 775.866 115.472H814.602C816.259 115.472 817.602 116.815 817.602 118.472V143.96C817.602 145.617 816.259 146.96 814.602 146.96H739.385C737.728 146.96 736.385 145.617 736.385 143.96V4.04093C736.385 2.38407 737.728 1.04092 739.385 1.04092H814.409C816.066 1.04092 817.409 2.38407 817.409 4.04092V29.3358Z" fill="currentColor"/><path d="M24.978 46.28C6.738 46.28 0.21 38.024 0.402 30.536C0.402 22.856 7.122 14.792 17.682 14.792C23.826 14.792 28.434 17.48 29.586 21.512C29.586 21.896 29.778 22.28 29.778 22.472C29.778 23.432 29.01 23.816 27.282 23.432C25.938 23.048 25.362 22.664 23.634 22.664C18.834 22.664 16.338 25.736 16.338 28.616C16.146 33.416 22.098 34.568 27.858 34.568C30.162 34.568 32.466 34.376 34.194 34.184C51.858 32.264 106.194 19.4 135.378 19.4C142.482 19.4 147.666 20.168 150.546 21.704C151.314 22.088 151.698 22.472 151.698 22.856C151.698 23.24 150.93 23.624 149.394 23.816C96.786 29.96 58.194 43.016 33.042 45.704C30.354 46.088 27.666 46.28 24.978 46.28ZM134.226 141.896C128.274 141.896 123.666 139.208 122.514 135.176C122.514 134.792 122.322 134.408 122.322 134.024C122.322 133.064 123.09 132.872 124.818 133.256C126.162 133.448 126.738 134.024 128.466 134.024C133.266 134.024 135.762 130.952 135.762 127.88C135.762 123.272 130.002 122.12 124.242 122.12C121.938 122.12 119.634 122.312 117.906 122.504C100.242 124.424 45.906 137.096 16.722 137.096C9.618 137.096 4.434 136.52 1.362 134.792C0.786 134.408 0.402 134.024 0.402 133.832C0.402 133.448 1.17 133.064 2.706 132.872C55.314 126.728 93.906 113.672 119.058 110.792C121.746 110.6 124.434 110.408 127.122 110.408C145.362 110.408 151.89 118.472 151.698 126.152C151.698 133.64 144.978 141.896 134.226 141.896Z" fill="currentColor"/></svg>`;
 /**
- * Shared <style> block — matches bridge-cloud-views / bridge-admin-ui brand tokens
- * (see bridge-cloud-views/src/global.css). Light mode, Inter, Bridge purple accent,
- * slate text scale, white card with subtle border.
+ * Shared <style> block: Bridge's brand tokens. Light mode, the system font,
+ * Bridge purple accent, slate text scale, white card with subtle border.
  */
 const SHARED_STYLES = `
   :root {
@@ -40,7 +39,7 @@ const SHARED_STYLES = `
   }
   * { box-sizing: border-box; }
   body {
-    font-family: 'Inter', -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
     background: var(--color-background-muted);
     color: var(--color-foreground);
     display: flex;
@@ -87,7 +86,6 @@ const SHARED_STYLES = `
     line-height: 1.55;
   }
 `;
-const FONT_LINK = `<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet">`;
 const SUCCESS_ICON = `<svg class="icon" viewBox="0 0 48 48" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><circle cx="24" cy="24" r="22" fill="#c4ffb8" stroke="#1fb800" stroke-width="2"/><path d="M14 24l7 7 13-14" fill="none" stroke="#1fb800" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
 const FAILURE_ICON = `<svg class="icon" viewBox="0 0 48 48" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><circle cx="24" cy="24" r="22" fill="#fee2e2" stroke="#d6210b" stroke-width="2"/><path d="M16 16l16 16M32 16L16 32" fill="none" stroke="#d6210b" stroke-width="3" stroke-linecap="round"/></svg>`;
 const DEFAULT_SUCCESS_HTML = `<!doctype html>
@@ -95,15 +93,14 @@ const DEFAULT_SUCCESS_HTML = `<!doctype html>
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Bridge CLI — Login successful</title>
-  ${FONT_LINK}
+  <title>Bridge CLI — Signed in</title>
   <style>${SHARED_STYLES}</style>
 </head>
 <body>
   <main class="card">
     <span class="logo">${BRIDGE_LOGO}</span>
     ${SUCCESS_ICON}
-    <h1>Login successful</h1>
+    <h1>Signed in</h1>
     <p>You can close this tab and return to your terminal.</p>
   </main>
 </body>
@@ -113,15 +110,14 @@ const FAILURE_HTML = (msg) => `<!doctype html>
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Bridge CLI — Login failed</title>
-  ${FONT_LINK}
+  <title>Bridge CLI — Sign-in failed</title>
   <style>${SHARED_STYLES} h1 { color: var(--color-bridge-red); }</style>
 </head>
 <body>
   <main class="card">
     <span class="logo">${BRIDGE_LOGO}</span>
     ${FAILURE_ICON}
-    <h1>Login failed</h1>
+    <h1>Sign-in failed</h1>
     <p>${escapeHtml(msg)}</p>
   </main>
 </body>
@@ -140,6 +136,7 @@ export function parseCallbackUrl(rawUrl) {
         state: url.searchParams.get('state') ?? undefined,
         error: url.searchParams.get('error') ?? undefined,
         errorDescription: url.searchParams.get('error_description') ?? undefined,
+        iss: url.searchParams.get('iss') ?? undefined,
         pathname: url.pathname,
     };
 }
@@ -147,10 +144,14 @@ export function parseCallbackUrl(rawUrl) {
  * Validates a parsed callback against the expected CSRF state. Returns the
  * verified `{code, state}` or throws a friendly error.
  */
-export function verifyCallback(parsed, expectedState) {
+export function verifyCallback(parsed, expectedState, expectedIssuer) {
+    // The state first: an error from a request this process never made is not reported as its own.
+    if (parsed.state && !constantTimeEqual(parsed.state, expectedState)) {
+        throw new LoopbackError('State mismatch on the sign-in callback (possible CSRF).', 'state_mismatch');
+    }
     if (parsed.error) {
         if (parsed.error === 'access_denied') {
-            throw new LoopbackError('Login cancelled.', 'access_denied');
+            throw new LoopbackError('Sign-in cancelled.', 'access_denied');
         }
         const desc = parsed.errorDescription ? `: ${parsed.errorDescription}` : '';
         throw new LoopbackError(`Authorization failed (${parsed.error})${desc}`, parsed.error);
@@ -162,7 +163,14 @@ export function verifyCallback(parsed, expectedState) {
         throw new LoopbackError('Authorization callback was missing the `state` parameter.', 'invalid_callback');
     }
     if (!constantTimeEqual(parsed.state, expectedState)) {
-        throw new LoopbackError('State mismatch on authorization callback (possible CSRF).', 'state_mismatch');
+        throw new LoopbackError('State mismatch on the sign-in callback (possible CSRF).', 'state_mismatch');
+    }
+    // RFC 9207: the callback must name its issuer, and it must be the one this sign-in is for.
+    if (expectedIssuer !== undefined) {
+        if (parsed.iss === undefined)
+            throw new LoopbackError('The sign-in callback does not name its issuer (iss).', 'issuer_missing');
+        if (parsed.iss !== expectedIssuer)
+            throw new LoopbackError('The sign-in callback names another issuer.', 'issuer_mismatch');
     }
     return { code: parsed.code, state: parsed.state };
 }
@@ -170,7 +178,7 @@ export function verifyCallback(parsed, expectedState) {
  * Boots the single-shot loopback listener on a random ephemeral port.
  *
  * Returns immediately with `{ redirectUri, result }`. The caller passes
- * `redirectUri` to the IdP, then awaits `result` for the verified `{code, state}`.
+ * `redirectUri` to the sign-in page, then awaits `result` for the verified `{code, state}`.
  *
  * The server:
  *  - Closes itself after the first GET to `/callback` completes its response.
@@ -179,7 +187,7 @@ export function verifyCallback(parsed, expectedState) {
  *  - Times out after `timeoutMs` (default 5 minutes).
  */
 export async function startLoopback(opts) {
-    const { expectedState, successRedirectUrl, successHtml = DEFAULT_SUCCESS_HTML, timeoutMs = 5 * 60_000, } = opts;
+    const { expectedState, expectedIssuer, successHtml = DEFAULT_SUCCESS_HTML, timeoutMs = 5 * 60_000, } = opts;
     let resolveResult;
     let rejectResult;
     const result = new Promise((res, rej) => {
@@ -196,29 +204,16 @@ export async function startLoopback(opts) {
             return;
         }
         try {
-            const verified = verifyCallback(parsed, expectedState);
-            if (successRedirectUrl) {
-                // Bounce the browser to the hosted success page on cloud-views.
-                // The user lands on auth.thebridge.dev/cli/login-complete instead of
-                // staying on 127.0.0.1 — branded UX.
-                res.statusCode = 302;
-                res.setHeader('Location', successRedirectUrl);
-                res.setHeader('Connection', 'close');
-                res.end(() => {
-                    server.close();
-                    server.closeAllConnections();
-                });
-            }
-            else {
-                res.statusCode = 200;
-                res.setHeader('Content-Type', 'text/html; charset=utf-8');
-                res.setHeader('Connection', 'close');
-                res.end(successHtml, () => {
-                    // Close listener AFTER the response flushes so the user actually sees the page.
-                    server.close();
-                    server.closeAllConnections();
-                });
-            }
+            const verified = verifyCallback(parsed, expectedState, expectedIssuer);
+            res.statusCode = 200;
+            res.setHeader('Content-Type', 'text/html; charset=utf-8');
+            res.setHeader('Cache-Control', 'no-store');
+            res.setHeader('Connection', 'close');
+            res.end(successHtml, () => {
+                // Close listener AFTER the response flushes so the person actually sees the page.
+                server.close();
+                server.closeAllConnections();
+            });
             resolveResult(verified);
         }
         catch (err) {

package/dist/auth/loopback.js.map

@@ -1 +1 @@
-{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/auth/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAiClC;;;;GAIG;AACH,MAAM,WAAW,GAAG,kjPAAkjP,CAAC;AAEvkP;;;;GAIG;AACH,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DrB,CAAC;AAEF,MAAM,SAAS,GAAG,4OAA4O,CAAC;AAE/P,MAAM,YAAY,GAAG,8SAA8S,CAAC;AAEpU,MAAM,YAAY,GAAG,8RAA8R,CAAC;AAEpT,MAAM,oBAAoB,GAAG;;;;;;IAMzB,SAAS;WACF,aAAa;;;;yBAIC,WAAW;MAC9B,YAAY;;;;;QAKV,CAAC;AAET,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;;;;;;IAMlC,SAAS;WACF,aAAa;;;;yBAIC,WAAW;MAC9B,YAAY;;SAET,UAAU,CAAC,GAAG,CAAC;;;QAGhB,CAAC;AAET;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAO7C,qEAAqE;IACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;QAC/C,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACjD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACjD,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;QACxE,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA2C,EAC3C,aAAqB;IAErB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,yBAAyB,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,0DAA0D,EAAE,kBAAkB,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,2DAA2D,EAAE,kBAAkB,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,2DAA2D,EAAE,gBAAgB,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAwB;IAC1D,MAAM,EACJ,aAAa,EACb,kBAAkB,EAClB,WAAW,GAAG,oBAAoB,EAClC,SAAS,GAAG,CAAC,GAAG,MAAM,GACvB,GAAG,IAAI,CAAC;IAET,IAAI,aAA2C,CAAC;IAChD,IAAI,YAAmC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,aAAa,GAAG,GAAG,CAAC;QACpB,YAAY,GAAG,GAAG,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,6CAA6C;QAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACpC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACvD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,gEAAgE;gBAChE,qEAAqE;gBACrE,qCAAqC;gBACrC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACrC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;oBACX,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACrC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE;oBACxB,gFAAgF;oBAChF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC/B,CAAC,CAAC,CAAC;YACL,CAAC;YACD,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE;gBAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACpC,GAAG,EAAE,CAAC;QACR,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAC7C,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,WAAW,CAAC;IAE7D,mDAAmD;IACnD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QACpC,YAAY,CACV,IAAI,aAAa,CACf,oDAAoD,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EACpF,SAAS,CACV,CACF,CAAC;QACF,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,uEAAuE;IACvE,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;IAExB,sEAAsE;IACtE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAC3D,iDAAiD;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,MAAM;QACN,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,+DAA+D;AAC/D,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/auth/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA4BlC;;;GAGG;AACH,MAAM,WAAW,GAAG,kjPAAkjP,CAAC;AAEvkP;;;GAGG;AACH,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DrB,CAAC;AAEF,MAAM,YAAY,GAAG,8SAA8S,CAAC;AAEpU,MAAM,YAAY,GAAG,8RAA8R,CAAC;AAEpT,MAAM,oBAAoB,GAAG;;;;;;WAMlB,aAAa;;;;yBAIC,WAAW;MAC9B,YAAY;;;;;QAKV,CAAC;AAET,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;;;;;;WAM3B,aAAa;;;;yBAIC,WAAW;MAC9B,YAAY;;SAET,UAAU,CAAC,GAAG,CAAC;;;QAGhB,CAAC;AAET;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAQ7C,qEAAqE;IACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;QAC/C,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACjD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACjD,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;QACxE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;QAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA2C,EAC3C,aAAqB,EACrB,cAAuB;IAEvB,+FAA+F;IAC/F,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,aAAa,CAAC,yDAAyD,EAAE,gBAAgB,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,yBAAyB,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,0DAA0D,EAAE,kBAAkB,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,2DAA2D,EAAE,kBAAkB,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,yDAAyD,EAAE,gBAAgB,CAAC,CAAC;IACvG,CAAC;IACD,2FAA2F;IAC3F,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,sDAAsD,EAAE,gBAAgB,CAAC,CAAC;QAChI,IAAI,MAAM,CAAC,GAAG,KAAK,cAAc;YAAE,MAAM,IAAI,aAAa,CAAC,4CAA4C,EAAE,iBAAiB,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAwB;IAC1D,MAAM,EACJ,aAAa,EACb,cAAc,EACd,WAAW,GAAG,oBAAoB,EAClC,SAAS,GAAG,CAAC,GAAG,MAAM,GACvB,GAAG,IAAI,CAAC;IAET,IAAI,aAA2C,CAAC;IAChD,IAAI,YAAmC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,aAAa,GAAG,GAAG,CAAC;QACpB,YAAY,GAAG,GAAG,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,6CAA6C;QAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACpC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;YACvE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE;gBACxB,kFAAkF;gBAClF,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE;gBAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACpC,GAAG,EAAE,CAAC;QACR,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAC7C,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,WAAW,CAAC;IAE7D,mDAAmD;IACnD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QACpC,YAAY,CACV,IAAI,aAAa,CACf,oDAAoD,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EACpF,SAAS,CACV,CACF,CAAC;QACF,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,uEAAuE;IACvE,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;IAExB,sEAAsE;IACtE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAC3D,iDAAiD;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,MAAM;QACN,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,iCAAiC;YACnC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,+DAA+D;AAC/D,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,61 @@
+import type { Discovery } from '../core/discovery.js';
+import { type Fetch } from '../core/http.js';
+import type { SessionStore, StoredSession } from './store.js';
+export interface TokenAnswer {
+    readonly access_token: string;
+    readonly token_type?: string;
+    readonly expires_in: number;
+    readonly refresh_token?: string;
+    readonly workspace?: string;
+}
+export interface SessionDeps {
+    readonly fetch: Fetch;
+    readonly store: SessionStore;
+    /** Where the renewal lock lives. */
+    readonly lockDir: string;
+    readonly now?: () => number;
+}
+/**
+ * The developer's session with the Bridge App: kept in the store, renewed
+ * with rotation (each renewal gives a new refresh token, saved before it is
+ * used), ended by revoking the refresh token.
+ */
+export declare class Sessions {
+    private readonly deps;
+    private readonly now;
+    constructor(deps: SessionDeps);
+    describeStore(): string;
+    /** Trades a sign-in code for tokens (PKCE: only the holder of the verifier can) and keeps them. */
+    exchangeCode(d: Discovery, code: string, verifier: string): Promise<StoredSession>;
+    read(issuer: string): Promise<StoredSession | null>;
+    /** Removes the session from this machine only. */
+    forget(issuer: string): Promise<void>;
+    /** The signed-in session for the issuer, or `not-signed-in`. */
+    current(d: Discovery): Promise<StoredSession>;
+    /** An access token that is good for at least a minute, renewed first if needed. */
+    accessToken(d: Discovery, options?: {
+        force?: boolean;
+    }): Promise<string>;
+    /**
+     * Renews the tokens, optionally for another workspace. Under a lock, and
+     * with the store read again inside it: a command that ran at the same
+     * time may have renewed already, and its refresh token is the only one
+     * still good.
+     */
+    renew(d: Discovery, options?: {
+        workspace?: string;
+        force?: boolean;
+        stale?: string;
+    }): Promise<StoredSession>;
+    /**
+     * Signs out: revokes the refresh token, which ends the session at Bridge,
+     * then forgets it here. Forgotten here even when Bridge cannot be
+     * reached, and then says so.
+     */
+    signOut(d: Discovery): Promise<{
+        revoked: boolean;
+        reason?: string;
+    }>;
+    private fromAnswer;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAQ,KAAK,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAK9D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAUD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,qBAAa,QAAQ;IAGP,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEN,IAAI,EAAE,WAAW;IAI9C,aAAa,IAAI,MAAM;IAIvB,mGAAmG;IAC7F,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAWlF,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIzD,kDAAkD;IAC5C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,gEAAgE;IAC1D,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC;IAMnD,mFAAmF;IAC7E,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAMnF;;;;;OAKG;IACG,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAmCxH;;;;OAIG;IACG,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB3E,OAAO,CAAC,UAAU;CAYnB"}

package/dist/auth/session.js

@@ -0,0 +1,142 @@
+import { CliError, SIGN_IN_AGAIN } from '../core/errors.js';
+import { call } from '../core/http.js';
+import { withLock } from './lock.js';
+/** Renew this long before the access token expires, so a call never carries one that runs out on the way. */
+const RENEW_BEFORE_MS = 60_000;
+function tokenAnswer(body) {
+    const answer = (body ?? {});
+    if (typeof answer['access_token'] !== 'string' || typeof answer['expires_in'] !== 'number') {
+        throw new CliError('misconfigured', 'The token endpoint answered without an access token.');
+    }
+    return answer;
+}
+/**
+ * The developer's session with the Bridge App: kept in the store, renewed
+ * with rotation (each renewal gives a new refresh token, saved before it is
+ * used), ended by revoking the refresh token.
+ */
+export class Sessions {
+    deps;
+    now;
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.now ?? Date.now;
+    }
+    describeStore() {
+        return this.deps.store.describe();
+    }
+    /** Trades a sign-in code for tokens (PKCE: only the holder of the verifier can) and keeps them. */
+    async exchangeCode(d, code, verifier) {
+        const { body } = await call(this.deps.fetch, {
+            method: 'POST',
+            url: d.token,
+            body: { grant_type: 'authorization_code', code, code_verifier: verifier, client_id: d.appId },
+        });
+        const session = this.fromAnswer(d, tokenAnswer(body), null, this.now());
+        await this.deps.store.write(session);
+        return session;
+    }
+    async read(issuer) {
+        return this.deps.store.read(issuer);
+    }
+    /** Removes the session from this machine only. */
+    async forget(issuer) {
+        await this.deps.store.remove(issuer);
+    }
+    /** The signed-in session for the issuer, or `not-signed-in`. */
+    async current(d) {
+        const session = await this.deps.store.read(d.issuer);
+        if (session === null)
+            throw new CliError('not-signed-in', `Not signed in to ${d.issuer}.`, { hint: SIGN_IN_AGAIN });
+        return session;
+    }
+    /** An access token that is good for at least a minute, renewed first if needed. */
+    async accessToken(d, options = {}) {
+        const session = await this.current(d);
+        if (!options.force && session.accessTokenExpiresAt - this.now() > RENEW_BEFORE_MS)
+            return session.accessToken;
+        return (await this.renew(d, { force: options.force, stale: session.accessToken })).accessToken;
+    }
+    /**
+     * Renews the tokens, optionally for another workspace. Under a lock, and
+     * with the store read again inside it: a command that ran at the same
+     * time may have renewed already, and its refresh token is the only one
+     * still good.
+     */
+    async renew(d, options = {}) {
+        return withLock(this.deps.lockDir, 'renew', async () => {
+            const session = await this.current(d);
+            const renewedMeanwhile = options.stale !== undefined && session.accessToken !== options.stale;
+            if (options.workspace === undefined && renewedMeanwhile && session.accessTokenExpiresAt - this.now() > RENEW_BEFORE_MS)
+                return session;
+            if (session.refreshToken === null) {
+                await this.deps.store.remove(d.issuer);
+                throw new CliError('session-ended', 'The session cannot be renewed.', { hint: SIGN_IN_AGAIN });
+            }
+            let body;
+            try {
+                ({ body } = await call(this.deps.fetch, {
+                    method: 'POST',
+                    url: d.token,
+                    body: {
+                        grant_type: 'refresh_token',
+                        refresh_token: session.refreshToken,
+                        client_id: d.appId,
+                        ...(options.workspace === undefined ? {} : { workspace: options.workspace }),
+                    },
+                }));
+            }
+            catch (error) {
+                // Refused for good: the session ended (signed out elsewhere, removed from the workspace, the token reused).
+                if (error instanceof CliError && error.kind === 'session-ended') {
+                    await this.deps.store.remove(d.issuer);
+                    throw new CliError('session-ended', `The session ended: ${error.message}`, { status: error.status, hint: SIGN_IN_AGAIN });
+                }
+                throw error;
+            }
+            const renewed = this.fromAnswer(d, tokenAnswer(body), session, session.signedInAt);
+            await this.deps.store.write(renewed);
+            return renewed;
+        });
+    }
+    /**
+     * Signs out: revokes the refresh token, which ends the session at Bridge,
+     * then forgets it here. Forgotten here even when Bridge cannot be
+     * reached, and then says so.
+     */
+    async signOut(d) {
+        const session = await this.deps.store.read(d.issuer);
+        if (session === null)
+            return { revoked: false, reason: 'not signed in' };
+        let revoked = false;
+        let reason;
+        try {
+            if (session.refreshToken !== null) {
+                await call(this.deps.fetch, { method: 'POST', url: d.revoke, body: { token: session.refreshToken, token_type_hint: 'refresh_token', client_id: d.appId } });
+                revoked = true;
+            }
+            else if (d.signOut !== null) {
+                await call(this.deps.fetch, { method: 'POST', url: d.signOut, headers: { authorization: `Bearer ${session.accessToken}` } });
+                revoked = true;
+            }
+        }
+        catch (error) {
+            reason = error instanceof Error ? error.message : String(error);
+        }
+        await this.deps.store.remove(d.issuer);
+        return reason === undefined ? { revoked } : { revoked, reason };
+    }
+    fromAnswer(d, answer, previous, signedInAt) {
+        return {
+            issuer: d.issuer,
+            appId: d.appId,
+            accessToken: answer.access_token,
+            accessTokenExpiresAt: this.now() + answer.expires_in * 1000,
+            // Rotation: the new refresh token replaces the old one, which is now spent.
+            refreshToken: answer.refresh_token ?? previous?.refreshToken ?? null,
+            workspace: answer.workspace ?? null,
+            signedInAt,
+        };
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAc,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,6GAA6G;AAC7G,MAAM,eAAe,GAAG,MAAM,CAAC;AAU/B,SAAS,WAAW,CAAC,IAAa;IAChC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACvD,IAAI,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3F,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAgC,CAAC;AAC1C,CAAC;AAUD;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IAGU;IAFZ,GAAG,CAAe;IAEnC,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpC,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,YAAY,CAAC,CAAY,EAAE,IAAY,EAAE,QAAgB;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,CAAC,CAAC,KAAK;YACZ,IAAI,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE;SAC9F,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,OAAO,CAAC,CAAY;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACpH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,WAAW,CAAC,CAAY,EAAE,UAA+B,EAAE;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;YAAE,OAAO,OAAO,CAAC,WAAW,CAAC;QAC9G,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACjG,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,CAAY,EAAE,UAAmE,EAAE;QAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC;YAC9F,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,gBAAgB,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;gBAAE,OAAO,OAAO,CAAC;YACvI,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,gCAAgC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;oBACtC,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,CAAC,CAAC,KAAK;oBACZ,IAAI,EAAE;wBACJ,UAAU,EAAE,eAAe;wBAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;wBACnC,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;qBAC7E;iBACF,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4GAA4G;gBAC5G,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBAChE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBACvC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,sBAAsB,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC5H,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YACnF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,CAAY;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACzE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC5J,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC7H,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IAEO,UAAU,CAAC,CAAY,EAAE,MAAmB,EAAE,QAA8B,EAAE,UAAkB;QACtG,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;YAC3D,4EAA4E;YAC5E,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE,YAAY,IAAI,IAAI;YACpE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,UAAU;SACX,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/sign-in.d.ts

@@ -0,0 +1,67 @@
+import type { Discovery } from '../core/discovery.js';
+import { type Fetch } from '../core/http.js';
+import { type StartedLoopback } from './loopback.js';
+import type { Sessions } from './session.js';
+import type { StoredSession } from './store.js';
+/** A workspace offered at sign-in, and what entering it would still ask for. */
+export interface WorkspaceChoice {
+    readonly id: string;
+    readonly name: string;
+    readonly needs?: unknown;
+}
+export type ChooseWorkspace = (choices: readonly WorkspaceChoice[]) => Promise<string>;
+export interface PasswordSignIn {
+    readonly email: string;
+    readonly password: string;
+    /** The workspace to enter; asked for with `chooseWorkspace` when the person has several and none is named. */
+    readonly workspace?: string;
+    readonly chooseWorkspace: ChooseWorkspace;
+}
+/**
+ * Email and password in the terminal, against the Bridge App's challenge
+ * endpoint. The Bridge App is a first-party client, so no page is needed.
+ * The code is bound with PKCE to this process and traded at once.
+ *
+ * 1. `{ email, password, code_challenge }` gives a code, or the workspace step.
+ * 2. The workspace step: `{ flow, workspace }` gives the code.
+ * 3. The token endpoint trades the code and the verifier for tokens.
+ */
+export declare function signInWithPassword(fetchFn: Fetch, sessions: Sessions, d: Discovery, input: PasswordSignIn): Promise<StoredSession>;
+export interface BrowserSignIn {
+    /** Bridge's sign-in page in hand-off mode. */
+    readonly signInPage: string;
+    readonly openBrowser: (url: string) => Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    /** Told the address when the browser cannot be opened, or always, so it can be opened by hand. */
+    readonly show: (message: string) => void;
+    readonly timeoutMs?: number;
+    /** For tests: called once the loopback listens. */
+    readonly onListening?: (loopback: StartedLoopback, url: string) => void;
+}
+/**
+ * The address of the sign-in page for this sign-in: the page signs in with
+ * the PKCE challenge and sends the browser back to the loopback address
+ * with the code and the state (hand-off mode). Only this process holds the
+ * verifier, so only it can trade the code.
+ */
+export declare function signInPageUrl(page: string, d: Discovery, request: {
+    codeChallenge: string;
+    redirectUri: string;
+    state: string;
+}): string;
+/**
+ * The sign-in page to open. The page the issuer publishes always wins. An
+ * override (`--sign-in-page`, `BRIDGE_SIGN_IN_PAGE`) is used only when the
+ * issuer publishes none, and only on the issuer's own origin, or on this
+ * machine for development: a page anywhere else could take the password
+ * and relay it. An override is never saved.
+ */
+export declare function chooseSignInPage(d: Discovery, override: string | undefined): {
+    page: string;
+    ignored?: string;
+};
+/** Browser sign-in through Bridge's own sign-in page, with a loopback on 127.0.0.1 and PKCE (RFC 8252, RFC 7636). */
+export declare function signInWithBrowser(sessions: Sessions, d: Discovery, input: BrowserSignIn): Promise<StoredSession>;
+//# sourceMappingURL=sign-in.d.ts.map

package/dist/auth/sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.d.ts","sourceRoot":"","sources":["../../src/auth/sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAQ,KAAK,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAgC,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AASvF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8GAA8G;IAC9G,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA2BxI;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACzE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CASxI;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAiB/G;AAED,qHAAqH;AACrH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CA0BtH"}

package/dist/auth/sign-in.js

@@ -0,0 +1,113 @@
+import { CliError } from '../core/errors.js';
+import { call } from '../core/http.js';
+import { isLocalHost, secureUrl } from '../core/urls.js';
+import { LoopbackError, startLoopback } from './loopback.js';
+import { codeChallengeFor, generateCodeVerifier, generateState } from './pkce.js';
+/**
+ * Email and password in the terminal, against the Bridge App's challenge
+ * endpoint. The Bridge App is a first-party client, so no page is needed.
+ * The code is bound with PKCE to this process and traded at once.
+ *
+ * 1. `{ email, password, code_challenge }` gives a code, or the workspace step.
+ * 2. The workspace step: `{ flow, workspace }` gives the code.
+ * 3. The token endpoint trades the code and the verifier for tokens.
+ */
+export async function signInWithPassword(fetchFn, sessions, d, input) {
+    const verifier = generateCodeVerifier();
+    const challenge = codeChallengeFor(verifier);
+    let { body } = await call(fetchFn, {
+        method: 'POST',
+        url: d.signIn,
+        body: {
+            email: input.email,
+            password: input.password,
+            code_challenge: challenge,
+            code_challenge_method: 'S256',
+            client_id: d.appId,
+            ...(input.workspace === undefined ? {} : { workspace: input.workspace }),
+        },
+    });
+    if (typeof body?.code !== 'string' && body?.next === 'workspace' && typeof body.flow === 'string') {
+        const choices = Array.isArray(body.workspaces) ? body.workspaces : [];
+        const workspace = await input.chooseWorkspace(choices);
+        ({ body } = await call(fetchFn, { method: 'POST', url: d.signIn, body: { flow: body.flow, workspace, client_id: d.appId } }));
+    }
+    const code = body?.code;
+    if (typeof code !== 'string') {
+        throw new CliError('unsupported-step', `Sign-in asks for a step the CLI cannot do in the terminal (${String(body?.next ?? 'none')}).`, {
+            hint: 'Sign in with the browser instead: `bridge auth login`.',
+        });
+    }
+    return sessions.exchangeCode(d, code, verifier);
+}
+/**
+ * The address of the sign-in page for this sign-in: the page signs in with
+ * the PKCE challenge and sends the browser back to the loopback address
+ * with the code and the state (hand-off mode). Only this process holds the
+ * verifier, so only it can trade the code.
+ */
+export function signInPageUrl(page, d, request) {
+    const url = new URL(page);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', d.appId);
+    url.searchParams.set('code_challenge', request.codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('redirect_uri', request.redirectUri);
+    url.searchParams.set('state', request.state);
+    return url.toString();
+}
+/**
+ * The sign-in page to open. The page the issuer publishes always wins. An
+ * override (`--sign-in-page`, `BRIDGE_SIGN_IN_PAGE`) is used only when the
+ * issuer publishes none, and only on the issuer's own origin, or on this
+ * machine for development: a page anywhere else could take the password
+ * and relay it. An override is never saved.
+ */
+export function chooseSignInPage(d, override) {
+    if (d.signInPage !== null) {
+        return override === undefined || override === d.signInPage ? { page: d.signInPage } : { page: d.signInPage, ignored: override };
+    }
+    if (override === undefined || override === '') {
+        throw new CliError('not-offered', 'This Bridge does not offer a sign-in page for the CLI yet.', {
+            hint: 'Sign in in the terminal instead: `bridge auth login --password`.',
+        });
+    }
+    const url = secureUrl(override);
+    if (url === null)
+        throw new CliError('misconfigured', `The sign-in page must be an https address (http only on localhost): ${override}`);
+    if (url.origin !== new URL(d.issuer).origin && !isLocalHost(url.hostname)) {
+        throw new CliError('misconfigured', `A sign-in page is taken only on the issuer's own address (${new URL(d.issuer).origin}) or on localhost, not ${url.origin}.`, {
+            hint: 'Sign in in the terminal instead: `bridge auth login --password`.',
+        });
+    }
+    return { page: url.toString() };
+}
+/** Browser sign-in through Bridge's own sign-in page, with a loopback on 127.0.0.1 and PKCE (RFC 8252, RFC 7636). */
+export async function signInWithBrowser(sessions, d, input) {
+    if (secureUrl(input.signInPage) === null) {
+        throw new CliError('misconfigured', `The sign-in page must be an https address (http only on localhost): ${input.signInPage}`);
+    }
+    const verifier = generateCodeVerifier();
+    const state = generateState();
+    const loopback = await startLoopback({ expectedState: state, expectedIssuer: d.issuer, timeoutMs: input.timeoutMs });
+    const url = signInPageUrl(input.signInPage, d, { codeChallenge: codeChallengeFor(verifier), redirectUri: loopback.redirectUri, state });
+    input.onListening?.(loopback, url);
+    try {
+        const opened = await input.openBrowser(url);
+        input.show(opened.ok
+            ? `Opened your browser to sign in. If it did not open, go to:\n  ${url}`
+            : `Open this address in your browser to sign in:\n  ${url}`);
+        const { code } = await loopback.result;
+        return await sessions.exchangeCode(d, code, verifier);
+    }
+    catch (error) {
+        if (error instanceof LoopbackError) {
+            throw new CliError(error.kind === 'access_denied' ? 'cancelled' : 'invalid', error.message);
+        }
+        throw error;
+    }
+    finally {
+        loopback.close();
+    }
+}
+//# sourceMappingURL=sign-in.js.map